fix(proxy): surface forwarded compact settlement failures

[mastertyko]

Summary

Fail closed when an HTTP-bridge owner cannot persist the only settlement of a
forwarded compact API-key reservation. The owner now attempts a fresh-repository
release and returns 502 usage_settlement_failed without retrying upstream or
penalizing the selected account.

Type of change

• fix: — bug fix (no behavior change beyond the bug)
• feat: — new user-facing feature or capability
• refactor: — internal refactor (no behavior change, no API change)
• docs: — documentation only
• chore: / ci: / build: — tooling, CI, packaging
• test: — test-only change
• Breaking change

Linked issue: none found in the bounded related-work search.

Related work:

• fix(proxy): settle API-key reservation before budget-exhausted compact preflight raises #1332 settled forwarded compact reservations on budget-exhausted terminals;
  this PR covers persistence failure after an upstream compact succeeds.
• fix(proxy): recover Codex sessions across bridge lineage changes #1549 concerns bridge/session continuity and does not overlap this settlement
  path or the changed files.

OpenSpec

• This PR includes / updates an OpenSpec change
• Not applicable — bug fix that matches the existing spec
• Not applicable — docs / CI / chore only
• This PR touches a codex-faithful path and preserves the existing compact
  request/response framing

Change directory:
openspec/changes/propagate-forwarded-compact-settlement-failure/

Changes

• Attempt an idempotent fail-safe reservation release through a fresh repository
  after compact finalization or release persistence fails, then surface the
  existing usage_settlement_failed error contract.
• Propagate trusted settlement provenance before compact retry, failover, and
  account-health classification.
• Add a signed /internal/bridge/responses regression proving one upstream call,
  no health-error handling, a 502 response, and final released reservation state,
  plus a hermetic unit regression for finalization and fail-safe release both failing.

Test plan

pytest tests/integration/test_proxy_compact.py -q
# 26 passed

pytest tests/unit/test_proxy_utils.py::test_compact_usage_settlement_surfaces_when_fail_safe_release_fails -q
# 1 passed

ruff check app/modules/proxy/_service/api_key_usage.py app/modules/proxy/_service/compact.py tests/integration/test_proxy_compact.py tests/unit/test_proxy_utils.py
ruff format --check app/modules/proxy/_service/api_key_usage.py app/modules/proxy/_service/compact.py tests/integration/test_proxy_compact.py tests/unit/test_proxy_utils.py
ty check app/modules/proxy/_service/api_key_usage.py app/modules/proxy/_service/compact.py tests/integration/test_proxy_compact.py tests/unit/test_proxy_utils.py
make architecture-check
openspec validate propagate-forwarded-compact-settlement-failure --strict
openspec validate --specs --strict
# 48 main specs passed

The focused regression also failed against the unmodified baseline as expected:
the old path returned HTTP 200 after swallowing the injected settlement failure.

Full-project ty check was attempted with Python 3.13 and reported one diagnostic
in unchanged tests/unit/test_settings_reference.py:36 for the Pydantic
_env_file constructor argument. The affected files pass targeted type checking;
required GitHub CI remains the authoritative full-project gate. Full local CI was
not run.

Screenshots / output

No dashboard-visible change. The signed forwarded-route regression observes:

HTTP 502
error.code = usage_settlement_failed
upstream compact calls = 1
account-health handlers = 0
reservation.status = released

Checklist

• Title is in Conventional Commits format.
• Bounded related work is documented; no matching issue was found.
• Added integration coverage at the externally failing forwarded route.
• Ran the relevant sensitive-change test, lint, format, type, architecture,
  and OpenSpec subset locally.
• openspec validate --specs --strict passes and OpenSpec verification is clean.
• Simplicity gates P1-P5 reviewed: no setting, setup step, README section,
  dashboard navigation, default, or dashboard pixels change.
• CHANGELOG.md is not edited.

[mastertyko]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 4440fc72e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".